trezuer-suit[.]framer[.]ai

Analysis of trezuer-suit.framer.ai shows a domain created on 06 Jan 2018 that is presently taken offline. The site resolves to the Amazon‑hosted address 31.43.160.6 located in the Netherlands and is registered through CSC Corporate Domains, Inc. The authoritative name servers are ns-114.awsdns-14.com, ns-1198.awsdns-21.org, ns-1902.awsdns-45.co.uk and ns-635.awsdns, confirming the use of AWS Route 53. TLS is provided by a Let’s Encrypt certificate (issuer E8) and the server advertises HSTS and HTTP/3, indicating a modern web stack. Front‑end technologies identified include Framer Sites and React, consistent with the hosting platform indicated by the domain suffix “framer.ai”. The HTTP response code returned for the root URL is 404, and the page title presented by the server is “Trezor Suite App (Official) | Desktop & Web Crypto Management”, a clear reference to the Trezor brand.

However, the threat intelligence tags the domain as impersonating the Sui brand, suggesting a possible mismatch between the displayed title and the intended victim brand. VirusTotal records indicate that two of ninety‑one scanning engines flagged the domain, and the domain appears on three external blocklists, including PhishDestroy, MetaMask and SEAL, all of which have already blocked the host. Gridinsoft assigns a trust score of 0 out of 100, reinforcing the malicious classification. The combination of a low trust score, blocklist presence, and the brand‑impersonation tag leads to an elevated risk rating.

Uncertainty remains regarding the exact payload or credential‑harvesting mechanism because the site content was not captured before it was taken offline, and no further samples of malicious code or URLs have been released. Defenders should continue to block the IP address 31.43.160.6 and the associated name servers, monitor for any re‑use of the same registrar or hosting infrastructure, and add the domain to internal blacklists.